Attacks and More Attacks CSCD 434 Spring 2019 Lecture 9 Attacks and More Attacks Root kits 1

Introduction Today ... Rootkits Includes Trojan/Backdoors Many other programs all bundled together For ease of use

What is a Rootkit? Collection of attacker tools installed after an intruder has gained access Log cleaners File/process/user hiding tools Network sniffers Backdoor programs Purpose to gain Administrator priviledge and maintain access The Legendary “Q”

What are Rootkits? Quick Answer Rootkits are software that makes an operating system lie

Rootkit Goals Remove evidence of original attack and activity that led to rootkit installation Hide future attacker activity Files, network connections, processes Prevent evidence from being logged Enable future access to system Install tools to widen scope of penetration Secure system so other attackers can’t take control of system from original attacker

Rootkits How do you get infected with a rootkit? Attacker can install it once they've obtained root access .. from other exploit Result of direct attack on a system Exploited a known vulnerability Password cracking, Social engineering Phishing with embedded link Website enticement - games, porn or torrents

How rootkits work Vulnerable system targeted Targeted system exploited Unpatched, Zero-day exploit, Poor configuration - leaving vulnerable processes up Results Targeted system exploited Root or Administrator access is obtained!!! Rootkit Payload is installed

Rootkit Operations Rootkit hides its presence Controls interfaces between Operating System components Intercepts and alters interface communications C:\> dir RootkitFile.exe C:\> no files found

Rootkit Operations Example What movie is this? Rootkit Operations Example 1. Application tries to see if executable file for rootkit X exists 2. Application calls FindFile API, via Operating System 3. Invisible to application, rootkit X has compromised API interface to file manager 4. Rootkit intercepts application’s call to FindFile, returns incorrect message file does not exist 5. Rootkit file is hidden from application and its users despite fact that it clearly still exists

History of Rootkits 1989: Phrack 25 Black Tie Affair: wtmp wiping 1994: Advisory CA-1994-01 about SunOS rootkits. 1996: Linux Rootkits (lrk3 released.)‏ 1997: Phrack 51 halflife article: LKM-based rootkits 1998: Silvio Cesare’s kernel patching via kmem. 1999: Greg Hoglund’s NT kernel rootkit paper. 2005: Sony ships CDs with rootkits that hide DRM and spyware that auto-installs when CD played 2006: SubVirt rootkit moves real OS to a VM 2016: Carbanak, reportedly began using Carberp to steal money from financial groups 2017: SmartService rootkit blocks security programs

Rootkits 2 Different ways of classifying rootkits User Mode Kernel Mode 11

Rootkits User Mode Rootkits Critical operating system components are replaced or modified by attacker to create backdoors, hide on the system Examples Linux RootKit 5 (lrk5)‏ T0rnKit for Linux, Solaris Other platform specific Rootkits SunOS, AIX, SCO, Solaris 12 12

Rootkits User Mode Rootkits What do they do? Attacker User Mode Rootkits Don’t add applications but replace existing system components with Trojan versions These Rootkits have existed since 1990’s What do they do? Don’t give you root privilege, should already be root Allows attacker to maintain root access and hide their presence on machine 13

Rootkits User Mode At a minimum Extra 1) Install backdoor for attacker 2) Hide evidence of system compromise Extra Collect information via sniffer for attacker Useful traffic such as passwords, other information 14

Rootkits User Mode Rootkits For example ... replace system programs Replace ssh or other login programs with one containing backdoor password for root access Replace ifconfig program so it hides presence of interface running in promiscuous mode Network card into promiscuous mode is symptom of sniffer programs System administrator can become suspicious of sniffer 15

Rootkits Above list shows typically replaced programs Program Original Function Rootkit Version Replaced du Disk utilization Lies about disk space Hides attackers tool space find Finds files and dirs Lies about attackers files ifconfig Shows interface status Masks promiscuous mode login Lets users login to system Also a backdoor root level password ls Contents of a directory Lies about rootkit files netstat Show processes listening Lies about ports TCP/UDP, used ps Process list Lies about processes attacker/wants to hide Above list shows typically replaced programs 16

User Mode Rootkit Replaces known OS files Tripwire should identify these User mode Rootkit Trojan Trojan Trojan good login pd ifconfig Tripwire Kernel

Tripwire Protection Open Source Tripwire detects changes to file system objects Tripwire first scans file system as directed by administrator and stores information on each file scanned in a database Later, same files are scanned and results compared against stored database values Changes are reported to the user Cryptographic hashes detect changes to files Open source is still around for Linux https://sectools.org/tool/tripwire/

Rootkits User Mode Rootkits Where can I get one? Unix/Linux http://www.packetstormsecurity.org/UNIX/penetration/rootkits Lrk6– Linux Rootkit 6 shv4 – another popular Linux rootkit Another URL- Precaution Recommended http://www.malwaredomainlist.com/ 19

Rootkits User Mode Rootkits For example, the real rootkit, lrk5 includes the following files: chfn ifconfig netstat syslogd chsh inetd passwd tcpd crontab killall pidof top du login ps sshd find ls rshd su 20

Rootkits Other files found with rootkits Sniffers Utilities linsniffer – network sniffer for Linux sniffchk – checks to make sure the sniffer is still running sniff, sniff-10mb, sniff-100mb – other sniffers Utilities - fix – fixes file checksum and timstamp information wted – wtmp editor, login file modifier z2 – erases entries from wtmp/utmp/lastlog bindshell – binds a root shell to a port, 31337 is default zap3 – erase tracks from all logs 21

Windows User Level Rootkits API Hook In Windows, dynamic linking happens with functions Code for dynamic linked functions stored in DLL's Dynamic Linked Libraries Reference to a Dynamic Linked function resolved at runtime Offset stored in Import Address Table (IAT)‏ Has function pointers filled in by the windows loader as the dlls are loaded

Windows User Level Rootkits More Details You can ... Hijack the Import Address Table (IAT)‏ Pointer will point to block of injected code Example: OpenFile call An Intrusion Detection System uses OpenFile Looking for unusual file names Rootkit intercepts the call, inspects parameters Sees its own name and returns results that the file doesn't exist

Windows User Level Rootkits More Details …. Windows system services implemented in a layered architecture Layer exposed to user applications when, for example, they need to call a KERNEL32.DLL function like OpenFile It is, however, oftentimes just a wrapper for a lower level call into NTDLL.DLL, library implements system calls

Taskmgr Gets Process Information 25

Technique: Import Address Table Hooks Take advantage of (IAT) Import Address Table Redirect calls to a hook dll 26

Taskmgr.exe Hooked to Hide Processes 27

Taskmgr.exe Hooked to Hide Processes 28

Operating System Design Intel has four privilege levels or rings for its processor Linux and many other OS vendors use only two rings User Mode : In this level some restriction in accessing system hardware and certain memory regions apply. User address space restricted to application memory maps Kernel Mode : Everything is allowed User Mode Supervisor / Kernel Mode

Rootkits Kernel Mode Rootkit What a kernel rootkit does More devious or harder to detect Modify kernel to completely and transparently transform system to attacker’s needs If you can’t trust kernel, you can’t trust anything on your system What a kernel rootkit does It redirects system calls made by other programs at a deeper level 30

Rootkits Kernel Mode Rootkits Example - Linux You want to login to system, so a call made to /bin/login Kernel maps request to a hidden program /bin/backdoorlogin Contains a backdoor whenever it is run that allows access for root When you run your file integrity checker, Tripwire, finds /bin/login It passes 31

Rootkits Kernel-level Root Kits The operating system itself is modified to allow backdoor access and allow attacker to hide Example Programs Knark for Linux Adore for Linux Rubilyn for OS X Hacker Defender - Windows 32 32

Rootkits Kernel Mode Rootkits Everything on your system looks pretty good but isn’t All execution is potentially altered Your system is a total lie! In addition to execution redirection kernel rooted machine hides processes that run and associated files 33

Rootkit Kernel Mode Rootkits Example of hidden processes A process is listening to port 31337 You run netstat to see what ports are open It will lie and hide that the port is open What could you do? Perform a scan of your system with nmap from the network - Would see the open 31337 port 34

Rootkits Creating a Kernel Rootkit Linux - Easiest LKM – Loadable Kernel Modules Used legitimately for dynamically updating system functionality Example Support for new disk drive Can either rebuild the kernel to support new capability or Dynamically update the kernel with a loadable kernel module 35

Comparison of Rootkits User Mode vs. Kernel Linux User mode Rootkit Trojan Trojan Trojan good login pd ifconfig Tripwire Kernel Kernel Rootkit good good good good login pd ifconfig Tripwire Kernel Trojan Module 36

Rootkits Kernel Mode rootkits Linux Windows Adore-ng for linux running kernels 2.4. 2.5 2.6 Runs as a loadable kernel module Full featured including module hiding Windows FU Name comes from su command in Unix for substituting users 37

Windows Kernel Level Lower Level Hooks Similar to Windows user level rootkit and Import Address Table Hooks Same effect in Kernel level rootkit by hooking System Service Dispatch Table (SSDT)‏ NTDLL provides the actual interface between user and kernel mode

Windows Kernel Level Steps to SSDT Hooking Kernelmode interrupt handler, KiSystemSerivce, Looks up ID of requestedservice in System Service Dispatch Table (SSDT)‏ On behalf of user application Kernel API’s themselves funneled to a single entry point in system service dispatch table Default service table, KeServiceDescriptorTable, defines primary kernel services implemented in ntoskrnl.exe Set of services - rootkits interested in intercepting Similar to IAT hooking, it only involves overwriting a single function pointer

Windows: Understand System Calls System calls are exported from NTDLL.DLL In NTDLL.DLL each system call has an associated numeric value NTDLL.DLL moves the hard-coded value into register, and calls sysenter (or int 2e)‏ NtQuerySystemInformation@16 proc near mov eax, 0F8h ; the system call number mov edx, 7FFE0300h ; do sysenter call dword ptr [edx] retn 10h _NtQuerySystemInformation@16 endp 40

Understanding A System Call Where would you subvert the process? The sysenter call moves transitions into kernel mode The system services dispatcher copies syscall parameters off the user stack and puts them into kernel memory The system services dispatcher executes the method in the System Services Dispatch Table (SSDT) at the requested system service number System Service Dispatch Table, SSDT 41

SSDT Hook Implementation Find the SSDT entry for NtQuerySystemInformation When our driver is started, we swap the value in the SSDT for that entry with a pointer to our implementation of NtQuerySystemInformation Notice that this is just like an IAT hook, but it attacks a different table 42

Rootkit Detection and Defense

Rootkits Defenses Against Rootkits 1. Don’t let them get root in the first place 2. Patch systems, close down services 3. Disable loadable modules in Linux Don’t need this functionality for critical systems like servers 44

Defenses Against Rootkits 3. File Integrity Check Computes MD5 hash on system files Creates a DB of hashes for critical system files Also can check against a known DB of file hashes, 36,645,143 files http://www.nsrl.nist.gov Store offline and periodically check your files against hashes for changes Tripwire original file integrity checker from Purdue 45

Rootkits Kernel Mode Rootkits – Finding them If entire system is a lie, how do you find them? If you scan your network with nmap Shows you ports open on your system Good idea to occasionally scan your own networks If you run a sniffer and ifconfig doesn’t show promiscuous mode, may be a problem 46

Windows Kernel Mode Detecting SSDT Hooks Scan table looking for invalid data Valid SSDT entries should all point to ntoskrnl.exe Some benign software uses SSDT hooks A white list is needed 47

Rootkits Detection Automated tool, chkrootkit program, free, Unix/Linux Available from: http://www.chkrootkit.org/ Searches for fingerprinting of user mode rootkits Shell script that checks system for binaries for rootkit modification Plus detect well-known LKM rootkits. Using the following commands chkrootkit searches for common files rootkits place on the system Awk, cut, echo, egrep, find, head, id, ls, netstat, ps, strings, sed, and uname. Also, searches for hidden processes by comparing contents of /proc directory with results from ps command 48

Backdoors and Rootkits Kernel Level Rootkits Detection Rootkit Hunter www.rootkit.nl/projects/rootkit_hunter.html Similar to chkrootkit Use it for second opinion For Windows rootkits GMER from Avast, http://www.gmer.net/ Rootkit Revealer www.sysinternals.com Blacklight www.f-secure.com/blacklight

Rootkits Kernel Level Rootkits Detection Host based IDS’s can also check for rootkits Virus scanners have signatures now of many rootkits Skilled attackers can bypass this by disabling virus scanner, then installing rootkit Still effective for less skilled attacks

Rootkits Cleanup After the initial attack a system may never be the same. A complete clean up and system recovery should be performed to prevent future attacks. It must be assumed that all information on the system during the time of the attack has been exposed. Locating all Trojan versions of standard system can be difficult. A system administrator should not trust any system utilities until they have been restored from a safe source such as distribution media. Unless you are positive that back ups were made before the security breach, backups discarded

References Joanna Rutkowska Rootkits Windows Rootkits - Good Details http://invisiblethingslab.com/itl/Resources.html Rootkits Windows Rootkits - Good Details http://www.tebyan.net/index.aspx?pid=31159&BookID=23844 &PageIndex=46&Language=3 Windows Rootkits Paper - Great “WINDOWS ROOTKITS A GAME OF “HIDE AND SEEK” http://whitepapers.hackerjournals.com/?p=10849

The End